Malicious PDF — malware analysis report

Static analysis result for SHA-256 da37825b5ddf61e0…

MALICIOUS

PDF

29.2 KB Created: 2020-04-06 07:40:56 +03:00 Authoring application: wkhtmltopdf 0.12.1.4 (via Qt 4.8.6)
MD5: 5f1cb335d2827658abdd4663e4a66b07 SHA-1: 324f4bea02ae7d3bab9de63623f95b098b47bec0 SHA-256: da37825b5ddf61e0606f2b5116b0b7ba9ac61d55f3c8facfc613b3318f1b61ce
62 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document exhibits characteristics of a link farm, with numerous external URLs embedded within its structure. The heuristic 'PDF_SEO_LINK_FARM' indicates a high volume of links, suggesting an attempt to manipulate search engine results or direct users to potentially malicious content. No scripts were extracted, and the document body is heavily obfuscated, making it difficult to determine a more specific user-facing lure beyond the presence of these links. The primary attack pattern involves redirecting users to external sites, as evidenced by the numerous URLs.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • External URI info PDF_URI
    PDF contains an external URL action
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://prtilogistics.com/uploads/1/3/1/0/131071038/131071038.html#movie+theater+in+ardmore+ok
    • http://theheslayyedhour.com/uploads/1/3/0/7/130776428/1378005.pdf
    • http://jerrywilmes.com/uploads/1/3/0/7/130739006/4068ff81d7e36.pdf
    • http://syncedupaudio.com/uploads/1/3/0/4/130435774/2901029.pdf
    • http://chrisiesconfections.com/uploads/1/3/0/7/130775742/7da85138.pdf
    • http://yogamamacb.com/uploads/1/3/0/8/130814711/3910490.pdf
    • http://tresovelhas.com/uploads/1/3/0/7/130776677/8599964.pdf
    • http://motherhustler.com/uploads/1/3/1/4/131411762/sozabubipu.pdf
    • http://shekina100organicanatural.com/uploads/1/3/0/5/130590738/badikarifukaxaze.pdf
    • http://joyearl.com/uploads/1/3/0/8/130813785/e99f3.pdf
    • http://constructiveaction.org/uploads/1/3/0/8/130874143/vodesodop.pdf
    • http://whatsintermittentfasting.com/uploads/1/3/0/5/130546977/6b9c5.pdf
    • http://sunnycaregivingservices.net/uploads/1/3/0/6/130640088/b4107.pdf
    • http://www.w3.org/1999/02/22-rdf-syntax-ns#
    • http://purl.org/dc/elements/1.1/
    • http://ns.adobe.com/pdf/1.3/
    • http://ns.adobe.com/xap/1.0/
    • http://ns.adobe.com/xap/1.0/mm/
    • http://ns.adobe.com/xap/1.0/rights/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004e34.bin
103dd75ca3150e5d583a9f2a405ae8248acebbdaf73eb1dba53da39313b73aca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4E34 6496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.